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REMARKS 

Claims 1-3, 6-14, 19-21, 23-24, and 27-46 are pending, with 
claims 1, 12, 20, 24, 31, and 33 being independent. 
Reconsideration and allowance of the above-referenced 
application are respectfully requested. 

Rejections Under 35 U.S.C. §102 

Claims 1-3, 6-14, 19-21, 23-24, and 27-46 stand rejected 
under 35 U.S.C. §102 (e) as allegedly being unpatentable over 
U.S. Application No. 2002/0103916 by Chen et al . (hereinafter 
"Chen"). This contention is respectfully traversed. 

Chen does not disclose each and every element of claim 1. 
For example, Chen fails to disclose "generating an average that 
relates to traffic of a specified type ; comparing current 
network traffic to said average , at first and second points of a 
network, ... and based on said comparing analyzing the information 
generated" (emphases added) as recited in claim 1. (See, e.g., 
P. 6, line 27 to P. 7 line 4 of the application as filed, which 
discloses that "To detect an uncharacteristically large number 
of SYN requests, the interface device can monitor the traffic 
through it to determine the normal level of traffic. This can 
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include continuously monitoring the traffic to determine a 
moving average . " ) 

Contrary to the Office's contention, the cited portions of 
Chen (P. 1 [0007-0008], P. 2 [0027], Fig. 6 item #32a, and Fig. 
4 items #42 and #44) do not disclose "generating an average that 
relates to traffic of a specified type " (emphases added) as 
recited in claim 1. In fact, Chen merely discloses "a process 
32a to collect statistics of packets" ( [0049] ) by " tracking 
ratios of SYNs to SYN ACKs and SYN ACKs to ACKs and comparing 
the ratios to threshold values" (emphases added; [0007] ) , and 
that "[t]he data collector samples 42 one (1) packet in every 
(n) packets and has counters to collect statistics about every 
packet" (emphasis added; [0037] ) . A ratio, as disclosed by 
Chen, is not an "average" as claimed. Although Chen does teach 
an architecture that is intended to thwart denial of service, 
nowhere is there any disclosure in Chen of the "generating an 
average" and comparing which is recited in claim 1. 

Claim 1 defines finding an average related to traffic of a 
specified type, comparing current network traffic to that 
average, and defines the comparison is used to generate 
information about unwanted communications. This is in no way 
disclosed by Chen. In fact, Chen discloses that "[t]he 
monitoring process includes a process to track ratios of SYNs to 
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SYN ACKs and SYN ACKs to ACKs and compare the ratios to 

threshold values" (emphases added; [0009] ) , and "the monitoring 
process in the gateway 2 6 can examine 82 a ratio of incoming to 
outgoing TCP packets" (emphasis added; [0061] ) . 

Chen's disclosure of "tracking ratios" stands in sharp 
contrast with "generating an average" as in claim 1. There is 
simply no disclosure of monitoring the network traffic to 
determine an average , and comparing current network traffic to 
that average in order to set a desired cut off. A ratio is not 
the same as an average. Further, there is no disclosure in Chen 
of using the techniques that are claimed herein to identify 
which of the points first carried the unwanted communications 
such as defined by claim 1. Therefore, Chen does not disclose 
all the features of claim 1, and claim 1 should be in condition 
for allowance. 

Independent claims 12, 20, 24, 31, and 33 recite similar 
features to those described above with reference to claim 1, and 
are hence allowable for at least the reasons provided above. 
For example, claim 12 recites, among other features: 
"generating an average ... and comparing said current 
communications with said average", and claim 20 recites, among 
other features: "generating an average ... and analyzing the 
information ... to said average" . 
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Claim 24 recites, among other features: "generating an 
average ... comparing current network traffic with said average" , 
and claim 31 recites, among other features: "generate an 
average ... comparing current network traffic with said average" . 
Claim 33 recites, among other features: "generate an average ... 
comparing current network with said average". Therefore, 
independent claims 12, 20, 24, 31, and 33 are patentably 
distinguishable over Chen for analogous reasons to those 
discussed for independent claim 1. Claims 2-3, 6-11, 13-14, 19, 
21, 23, 27-30, 32, and 34-46 depend generally from claim 1, 12, 
20, 24, 31, or 33. Thus, these dependent claims are allowable 
for at least the reasons provided above. 

Additionally, many of the dependent claims are 
independently allowable. For example, claim 36 recites that 
"said average is a moving average of the specified type of 
network traffic" (emphasis added) , which is further novel over 
Chen. The portions of Chen (P. 5, [0058-0061]) cited by the 
Office do not disclose the limitations of claim 36. As 
discussed above, Chen discloses "the monitoring process in the 
gateway 2 6 can examine 82 a ratio of incoming to outgoing TCP 
packets" (emphasis added; [0061] ) . Chen does not disclose 
"generating an average" and "comparing current network traffic 
to said average" as recited in claim 1, let alone the additional 
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limitation of claim 36, which specifies that the "average is a 
moving average." Therefore, claim 3 should be allowable for at 
least this additional reason. 

Concluding Comments 

It is believed that all of the pending claims have been 
addressed in this paper. However, failure to address a specific 
rejection, issue or comment, does not signify agreement with or 
concession of that rejection, issue or comment. In addition, 
because the arguments made above are not intended to be 
exhaustive, there may be reasons for patentability of any or all 
pending claims (or other claims) that have not been expressed. 
Finally, nothing in this paper should be construed as an intent 
to concede any issue with regard to any claim, except as 
specifically stated in this paper, and the amendment of any 
claim does not necessarily signify concession of unpatentability 
of the claim prior to its amendment. 

Applicants ask that all claims be allowed. Please apply 
applicable charges or credits to Deposit Account No. 06-1050. 
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